xa13p[.]com

Analysis of xa13p.com, created on 21 February 2026 and registered through NiceNIC International Group Co., Limited, shows that the domain was used to host a page titled “XA13P Official Website Presale Get Up to 200% Bonus!”. The site lacked an SSL certificate, indicating that traffic was not encrypted. DNS resolution points to 172.67.139.134, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The domain employed Cloudflare’s name servers eric.ns.cloudflare.com and vita.ns.cloudflare.com, a common choice for malicious operators seeking rapid deployment and mitigation of takedown attempts. Reputation services flag the domain as malicious.

VirusTotal recorded detections from 14 of 93 scanned vendors, confirming a consensus of malicious classification. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on at least one public blocklist. AlienVault OTX references the domain in a single threat‑intel pulse, and PhishDestroy has also listed it as blocked. The combination of multiple independent detections, a zero trust score, and blocklist inclusion reinforces the elevated risk assessment. The current HTTP status is “offline”, suggesting the site has been taken down or is no longer serving content.

However, the historical evidence indicates that the domain was actively used for a phishing campaign promising inflated presale bonuses, a typical lure to harvest credentials or funds. No additional indicators such as malicious payload hashes, command‑and‑control infrastructure, or observed victim reports were provided, leaving the full scope of the campaign uncertain. Defenders should block DNS resolution to 172.67.139.134 for xa13p.com, add the domain to web‑filter and email‑filter block lists, and monitor for any residual traffic or credential submissions that reference the “XA13P” brand or the 200 % bonus language. Continuous re‑scanning of the domain and its IP address is advised in case the site is re‑hosted elsewhere.